Host access control method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of computers, and discloses a host access control method and device, electronic equipment and a storage medium, the method comprises the following steps: when a proxy server in long connection with each service server monitors the update change of a policy rule, issuing the updated policy rule to each service server; based on the updated strategy rule, performing access control on the traffic packets of the access hosts corresponding to the business servers through the business servers; wherein the strategy rule is used for determining flow monitoring and flow packets allowed to be accessed or denied to be accessed, so that the access control efficiency and synchronism among the service servers are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a host access control method, device, electronic equipment and storage medium. Background Art

[0002] With the rapid development of emerging technologies such as cloud computing and microservices, more and more companies are building their own small data centers. While achieving fast and flexible deployment and allocation of resources, the large number of mutual access requirements between different businesses has led to uncontrollable and invisible east-west traffic within the enterprise data center.

[0003] Traditional firewall tools are difficult to deploy in a distributed manner. Users are required to log in to each machine to execute command configurations, and there is no unified entry to view policy rules. This makes it difficult to synchronize policy rules between business servers, which easily leads to low access control efficiency between business servers. Summary of the invention

[0004] In view of this, the present invention provides a host access control method, device, electronic device and storage medium, which solves the technical problem that policy rules between various business servers are difficult to synchronize, which easily leads to low access control efficiency between various business servers.

[0005] A first aspect of the present invention provides a host access control method, comprising:

[0006] When the proxy server that is permanently connected to each service server detects the update of the policy rules, the updated policy rules are sent to each of the service servers respectively;

[0007] Based on the updated policy rules, access control is performed on the traffic packets of the corresponding access hosts through each of the business servers; wherein the policy rules are used to determine the traffic packets for traffic monitoring, permission to access or denial of access.

[0008] Preferably, the device further comprises:

[0009] The resident proxy servers deployed by each of the business servers are connected to the proxy server through the TCP protocol.

[0010] Preferably, the device further comprises:

[0011] Performing an update operation on the policy rules through an interface of the host, wherein the update operation includes adding, deleting and modifying the policy rules;

[0012] The policy rules after the update operation are updated to the policy rule database for storage.

[0013] Preferably, the updated policy rule is an access control policy rule, and the access control policy rule is used to determine the traffic packets that are allowed to access or denied to access;

[0014] The method of performing access control on the flow packets of the access hosts respectively corresponding to the service servers based on the updated policy rules includes:

[0015] The access control policy rules are respectively issued to the inbound direction linked list and the outbound direction linked list in each of the service servers;

[0016] Access control is performed on traffic packets flowing in the inbound direction and the outbound direction respectively according to the access control policy rules corresponding to the inbound direction linked list and the outbound direction linked list respectively.

[0017] Preferably, the updated policy rule is a flow monitoring policy rule, and the flow monitoring policy rule is used to match the flow packets requiring flow monitoring;

[0018] The method of performing access control on the flow packets of the access hosts respectively corresponding to the service servers based on the updated policy rules includes:

[0019] The traffic monitoring strategy rules are respectively issued to the inbound direction linked list and the outbound direction linked list in each of the service servers;

[0020] Matching the traffic packets flowing in the inbound direction and the outbound direction respectively according to the traffic monitoring policy rules corresponding to the inbound direction linked list and the outbound direction linked list respectively;

[0021] If the match is successful, the flow size of the flow packet is accumulated, and the flow accumulation result of the flow packet is updated to the flow monitoring field in the flow monitoring strategy rule;

[0022] If the match is unsuccessful, the flow rate monitoring is not performed on the flow packet.

[0023] Preferably, matching the flow packets flowing in the inbound direction and the outbound direction respectively according to the flow monitoring policy rules corresponding to the inbound direction linked list and the outbound direction linked list respectively includes:

[0024] Analyze the flow packets corresponding to the inbound direction or the outbound direction to obtain flow packet features;

[0025] Determine the traffic packet hash value according to the traffic packet characteristics, match the traffic packet hash value with the traffic packet hash value preset in the traffic monitoring policy rules, and determine whether the traffic packet hash value is the same as the traffic packet hash value preset in the traffic monitoring policy rules.

[0026] In a second aspect, the present invention further provides a host access control device, comprising:

[0027] A policy delivery module, used to deliver the updated policy rules to each of the business servers when the proxy server that is permanently connected to each of the business servers detects the update of the policy rules;

[0028] The access control module is used to perform access control on the traffic packets of the access hosts respectively corresponding to each other through each of the business servers based on the updated policy rules; wherein the policy rules are used to determine the traffic packets for traffic monitoring, access permission or access denial.

[0029] In a third aspect, the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the host access control method as described in the first aspect.

[0030] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed, implements the steps of the host access control method as described in the first aspect.

[0031] In a fifth aspect, the present invention further provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, wherein when the program instructions are executed by a computer, the computer executes the steps of the host access control method as described in the first aspect.

[0032] It can be seen from the above technical solution that when the present invention monitors the update changes of policy rules through the proxy server, the updated policy rules are uniformly sent to each business server, so that the policy rules between each business server are synchronized, and through the updated policy rules, each business server performs access control on the traffic packets of the corresponding access host, thereby improving the access control efficiency and synchronization between each business server. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 An application environment of a host access control method provided by an embodiment of the present invention;

[0034] Figure 2 A flowchart of a host access control method provided by an embodiment of the present invention;

[0035] Figure 3 The inbound policy rules provided by the embodiment of the present invention;

[0036] Figure 4The outbound policy rules provided by the embodiment of the present invention;

[0037] Figure 5 A schematic diagram of the structure of a host access control device provided by an embodiment of the present invention;

[0038] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] The host access control method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the host is connected to the policy rule database network through the http protocol server, the proxy server is connected to the policy rule database network, and a resident proxy service is deployed in each business server, and the resident proxy server deployed by each business server is connected to the proxy server through the tcp protocol for a long connection, wherein the long connection can be connected using the tcp protocol.

[0041] The user can update the policy rules through the interface (UI) of the host, and the update operation includes adding, deleting and modifying the policy rules; the policy rules after the update operation are updated to the policy rule database for storage.

[0042] It is understandable that users can add, modify or delete policy rules as needed to adapt to different business scenarios. For example, the same policy rules can be set for a group of servers, which helps to simplify the management and maintenance of policies.

[0043] At the same time, by expanding the kernel traffic monitoring function module, the traffic information can be collected on each host through the host's interface, and the traffic information monitoring function can be uniformly displayed on the host's web interface.

[0044] For each policy rule, it includes but is not limited to fields such as rule description, protocol (TCP / UDP / ALL), source IP address, source port, destination IP address, destination port, monitored traffic size and policy (allow / deny / monitor).

[0045] The proxy server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The host can be a PC terminal, etc.

[0046] like Figure 2 As shown, the host access control method provided by the embodiment of the present application includes the following steps S1 to S2. Among them:

[0047] Step S1: When the proxy server that is permanently connected to each service server detects an update of a policy rule, the proxy server sends the updated policy rule to each service server.

[0048] Among them, since the proxy server can monitor the update changes of policy rules by monitoring the feedback of the policy rule database, and send the updated policy rules to each business server respectively, it can achieve unified one-time policy rule sending and synchronize the policy rules between each business server.

[0049] Step S2: Based on the updated policy rules, each service server performs access control on the traffic packets of the corresponding access hosts; wherein the policy rules are used to determine the traffic packets for traffic monitoring, access permission or access denial.

[0050] Among them, the policy rules are divided into different types of policy rules, and access control is performed on traffic packets accessing the host based on the different types of policy rules.

[0051] It should be noted that when the embodiment of the present application monitors the update changes of the policy rules through the proxy server, the updated policy rules are uniformly sent to each business server, so that the policy rules between the business servers are synchronized, and through the updated policy rules, each business server performs access control on the traffic packets of the corresponding access host, thereby improving the access control efficiency and synchronization between the business servers.

[0052] In some embodiments, the updated policy rule is an access control policy rule, and the access control policy rule is used to determine the traffic packets that are allowed to access or denied to access. Based on the updated policy rule, the process of performing access control on the traffic packets of the access hosts respectively corresponding to each other through each business server includes:

[0053] Step S201: Send access control policy rules to the inbound direction linked list and the outbound direction linked list in each service server respectively.

[0054] Among them, the host is divided into inbound and outbound directions. The inbound direction refers to the traffic packets sent by other machines to the host, and the outbound direction refers to the traffic packets from the host to other machines.

[0055] Step S202: perform access control on the traffic packets flowing in the inbound direction and the outbound direction respectively according to the access control policy rules corresponding to the inbound direction linked list and the outbound direction linked list respectively.

[0056] In actual applications, for the policy rules in the inbound direction, such as Figure 3 As shown, the access control policy rules include allowing and denying access control. The business server sends policy rules in the inbound hook point in the kernel filter chain list through the kernel command line tool iptables command, so that the kernel can complete traffic filtering in the inbound direction of the host. Among them, by matching the traffic packets in the inbound direction of the host, the traffic packets are subjected to corresponding access control. Among them, the matching method can be compared by calculating the hash value. When the hash value is consistent with the hash value of the policy rule, access control is performed according to the corresponding access control instruction (such as allow or deny).

[0057] For outbound policy rules, such as Figure 4 As shown, the business server issues policy rules in the outbound hook point in the kernel filter chain list through the kernel command line tool iptables command, so that the kernel can complete traffic filtering in the outbound direction of the host. Among them, by matching the outbound traffic packets of the host, corresponding access control is performed on the traffic packets. Among them, the matching method can be compared by calculating the hash value. When the hash value is consistent with the hash value of the policy rule, access control is performed according to the corresponding access control instruction (such as allow or deny).

[0058] In some embodiments, the updated policy rule is a traffic monitoring policy rule, which is used to match traffic packets that require traffic monitoring. Traffic monitoring can set a traffic monitoring function for certain rules to facilitate users to troubleshoot and locate abnormal traffic.

[0059] Based on this, based on the updated policy rules, the process of performing access control on the traffic packets of the corresponding access hosts through each service server includes:

[0060] Step S211: Send the traffic monitoring policy rules to the inbound direction linked list and the outbound direction linked list in each service server respectively.

[0061] Step S212: Match the traffic packets flowing in the inbound direction and the outbound direction respectively according to the traffic monitoring policy rules corresponding to the inbound direction linked list and the outbound direction linked list respectively.

[0062] Specifically, the process of matching traffic packets flowing in the inbound and outbound directions includes:

[0063] Step S2121: Analyze the traffic packets corresponding to the inbound direction or the outbound direction to obtain traffic packet features.

[0064] Among them, Figure 3 and 4 As shown, the traffic packet includes traffic packet features, such as a five-tuple (source IP, source port, destination IP, destination port, protocol).

[0065] Step S2122, determine the traffic packet hash value according to the traffic packet characteristics, match the traffic packet hash value with the traffic packet hash value preset in the traffic monitoring policy rules, and determine whether the traffic packet hash value is the same as the traffic packet hash value preset in the traffic monitoring policy rules.

[0066] Among them, the traffic packet hash value calculated based on the five-tuple (source IP address, source port, destination IP address, destination port, protocol) carried in the data packet is matched with the hash value calculated from the five-tuple of the traffic monitoring policy rule.

[0067] Step S213: If the match is successful, the flow size of the flow packet is accumulated, and the flow accumulation result of the flow packet is updated to the flow monitoring field in the flow monitoring strategy rule.

[0068] The traffic size of the traffic packet includes the number of bytes and the number of packets of the traffic packet. Each traffic monitoring policy rule has a traffic monitoring field in the policy rule database, and the traffic monitoring field records the number of bytes and the number of packets of the traffic packet.

[0069] After the business server completes the traffic monitoring and matching of the traffic packet, the kernel module of the business server calculates and accumulates the number of bytes of the data packet, the number of packets + 1, and stores the traffic size of the statistical traffic packet as a local file at regular intervals (such as 10s). Each line in the local file is a byte count of the number of packets for each policy rule. When the business server detects changes in the local file, it parses the local file and then sends the statistical data of the local file to the proxy server. The proxy server updates the traffic size data of the traffic packet in the policy rule database based on the statistical data of the local file.

[0070] Step S214: If the match is unsuccessful, no flow monitoring is performed on the flow packet.

[0071] It is understandable that after the traffic packet completes the traffic monitoring policy rule matching, other types of policy rules can be matched. If all types of policy rules fail to match successfully, the traffic packet is discarded.

[0072] Based on the same inventive concept, an embodiment of the present application also provides a host access control device for implementing the above-mentioned host access control method.

[0073] The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more host access control device embodiments provided below can refer to the limitations on the host access control method above, and will not be repeated here.

[0074] like Figure 5 As shown, an embodiment of the present application provides a host access control device, including:

[0075] The policy delivery module 100 is used to deliver the updated policy rules to each service server when the proxy server that is permanently connected to each service server detects the update change of the policy rules.

[0076] The access control module 200 is used to perform access control on the traffic packets of the corresponding access hosts through each business server based on the updated policy rules; wherein the policy rules are used to determine the traffic packets for traffic monitoring, permission to access or denial of access.

[0077] In some embodiments, the device further comprises:

[0078] The long connection module is used to establish a long connection between the resident proxy server deployed on each business server and the proxy server through the TCP protocol.

[0079] In some embodiments, the device further comprises:

[0080] An update operation module is used to update the policy rules through the interface of the host, and the update operation includes adding, deleting and modifying the policy rules;

[0081] The policy storage module is used to update the policy rules after the update operation into the policy rule database for storage.

[0082] In some embodiments, the updated policy rule is an access control policy rule, and the access control policy rule is used to determine the traffic packets that are allowed to access or denied to access.

[0083] The access control module 200 is specifically used to send access control policy rules to the inbound direction linked list and the outbound direction linked list in each business server respectively; according to the access control policy rules corresponding to the inbound direction linked list and the outbound direction linked list respectively, access control is performed on the traffic packets flowing through the inbound direction and the outbound direction respectively.

[0084] In some embodiments, the updated policy rule is a traffic monitoring policy rule, and the traffic monitoring policy rule is used to match traffic packets that require traffic monitoring;

[0085] The access control module 200 is specifically used to send the traffic monitoring policy rules to the inbound direction linked list and the outbound direction linked list in each business server respectively; according to the traffic monitoring policy rules corresponding to the inbound direction linked list and the outbound direction linked list respectively, the traffic packets flowing through the inbound direction and the outbound direction are matched; if the match is successful, the traffic size of the traffic packet is accumulated, and the traffic accumulation result of the traffic packet is updated to the traffic monitoring field in the traffic monitoring policy rule; if the match is unsuccessful, the traffic packet is not monitored.

[0086] Among them, according to the flow monitoring policy rules corresponding to the inbound direction chain table and the outbound direction chain table respectively, the flow packets flowing in the inbound direction and the outbound direction are matched respectively, including:

[0087] Analyze the traffic packets corresponding to the inbound or outbound directions to obtain traffic packet features;

[0088] Determine the traffic packet hash value according to the traffic packet characteristics, match the traffic packet hash value with the traffic packet hash value preset in the traffic monitoring policy rules, and determine whether the traffic packet hash value is the same as the traffic packet hash value preset in the traffic monitoring policy rules.

[0089] like Figure 6 As shown, an embodiment of the present application also provides an electronic device, the electronic device 10 includes a memory 20 and a processor 30, the memory 20 stores a computer program, and when the computer program is executed by the processor 30, the processor 30 executes the steps of the host access control method in any of the above embodiments.

[0090] An embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed, the steps of the host access control method in any of the above embodiments are implemented.

[0091] An embodiment of the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions, wherein when the program instructions are executed by a computer, the computer executes the steps of the host access control method in any of the above embodiments.

[0092] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, electronic devices, computer storage media and computer program products can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0093] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or apparatus.

[0094] In several embodiments provided by the present invention, it is understood that each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and a part of a module, a program segment or a code includes one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved.

[0095] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, electronic devices, computer storage media, computer program products and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0096] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0097] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0098] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for executing all or part of the steps of the method described in each embodiment of the present invention through a computer device (which can be a personal computer, server, or network device, etc.). The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (full name in English: Read-Only Memory, English abbreviation: ROM), random access memory (full name in English: Random Access Memory, English abbreviation: RAM), disk or optical disk and other media that can store program codes.

[0099] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A host access control method, characterized in that: include: When the proxy server that is permanently connected to each service server detects the update of the policy rules, the updated policy rules are sent to each of the service servers respectively; Based on the updated policy rules, access control is performed on the traffic packets of the corresponding access hosts through each of the business servers; wherein the policy rules are used to determine the traffic packets for traffic monitoring, permission to access or denial of access.

2. The host access control method according to claim 1, characterized in that: Also includes: The resident proxy servers deployed by each of the business servers are connected to the proxy server through the TCP protocol.

3. The host access control method according to claim 1, characterized in that: Also includes: Performing an update operation on the policy rules through an interface of the host, wherein the update operation includes adding, deleting and modifying the policy rules; The policy rules after the update operation are updated to the policy rule database for storage.

4. The host access control method according to claim 1, characterized in that: The updated policy rule is an access control policy rule, and the access control policy rule is used to determine the traffic packets that are allowed to access or denied to access; The method of performing access control on the flow packets of the access hosts respectively corresponding to the service servers based on the updated policy rules includes: The access control policy rules are respectively issued to the inbound direction linked list and the outbound direction linked list in each of the service servers; Access control is performed on the traffic packets flowing in the inbound direction and the outbound direction respectively according to the access control policy rules respectively corresponding to the inbound direction linked list and the outbound direction linked list.

5. The host access control method according to claim 1, characterized in that: The updated policy rule is a flow monitoring policy rule, and the flow monitoring policy rule is used to match the flow packets that need flow monitoring; The method of performing access control on the flow packets of the access hosts respectively corresponding to the service servers based on the updated policy rules includes: The traffic monitoring strategy rules are respectively issued to the inbound direction linked list and the outbound direction linked list in each of the service servers; Matching the traffic packets flowing in the inbound direction and the outbound direction respectively according to the traffic monitoring policy rules corresponding to the inbound direction linked list and the outbound direction linked list respectively; If the match is successful, the flow size of the flow packet is accumulated, and the flow accumulation result of the flow packet is updated to the flow monitoring field in the flow monitoring strategy rule; If the match is unsuccessful, the flow rate monitoring is not performed on the flow packet.

6. The host access control method according to claim 1, characterized in that: The matching of the flow packets flowing in the inbound direction and the outbound direction respectively according to the flow monitoring policy rules respectively corresponding to the inbound direction linked list and the outbound direction linked list includes: Analyzing the flow packets corresponding to the inbound direction or the outbound direction to obtain flow packet features; Determine the traffic packet hash value according to the traffic packet characteristics, match the traffic packet hash value with the traffic packet hash value preset in the traffic monitoring policy rules, and determine whether the traffic packet hash value is the same as the traffic packet hash value preset in the traffic monitoring policy rules.

7. A host access control device, characterized in that: include: A policy delivery module, used to deliver the updated policy rules to each of the business servers when the proxy server that is permanently connected to each of the business servers detects the update of the policy rules; The access control module is used to perform access control on the traffic packets of the access hosts respectively corresponding to each other through each of the business servers based on the updated policy rules; wherein the policy rules are used to determine the traffic packets for traffic monitoring, access permission or access denial.

8. An electronic device, characterized in that: The electronic device includes a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the processor executes the steps of the host access control method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed, the steps of the host access control method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, wherein when the program instructions are executed by a computer, the computer is caused to perform the steps of the host access control method according to any one of claims 1 to 6.

Images